How to Prevent Sensitive Data in Amazon SNS Messages?
A development team is building an application that will use an Amazon API Gateway REST API and AWS Lambda functions to receive and process requests. The Lambda functions will deliver messages to an Amazon SNS topic. External stakeholders subscribe to the SNS topic. The company wants to prevent sensitive data from being published to the SNS topic. Which solution will meet these requirements?
Community Insight
The exam tests whether you know SNS data protection policies operate on message content, not just access control; the trap is choosing a discovery or threat-detection service that cannot redact the publication path.
This question tests how to stop sensitive data from reaching an Amazon SNS topic that external stakeholders subscribe to. The answer is A: an SNS data protection policy can identify and redact sensitive data in published messages.
A common mistake is selecting Amazon Macie because it finds sensitive data, but Macie scopes S3 data discovery and does not inspect or redact SNS messages in transit.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Amazon SNS data protection policies are designed for message content protection. You associate the policy with the SNS topic and define statements using data identifiers and actions such as audit, deny, or redact. That means sensitive data can be detected and prevented from being published, or masked before external subscribers receive it. Option A directly applies the native SNS control to the Lambda-to-SNS publication path.Why the Other Options Are Wrong
Amazon Macie discovers and classifies sensitive data in Amazon S3; it does not intercept SNS publishes or redact message payloads in a Lambda workflow. GuardDuty Lambda Protection looks for runtime threats and suspicious activity, not custom sensitive-data patterns with redaction actions. Amazon Inspector scans Lambda code and dependencies for vulnerabilities and does not inspect runtime message content. None of these services provides the in-line SNS content control that the question requires.Community Comment Notes
Bad_Mat explicitly backs this choice, stating “The correct answer is A.” and describing the need to associate a data protection policy with the SNS topic and define statements that identify and protect sensitive data. No commenter proposes a credible alternative that would redact SNS message contents before publication. The community view aligns with the native SNS data protection policy capability.Official Reference
Exam Strategy
When a question asks how to prevent sensitive data from leaving a managed messaging service, look first for that service's native data protection or content-redaction feature. Discovery tools such as Macie, threat detectors such as GuardDuty, and vulnerability scanners such as Inspector are usually distractors unless the scenario explicitly asks for finding or alerting rather than prevention.
Frequently Asked Questions
Why can't Amazon Macie redact sensitive data before an SNS publish?
Macie discovers sensitive data in Amazon S3, not in SNS message payloads; it cannot sit in the Lambda-to-SNS path and redact messages.
Does an SNS data protection policy block or only audit sensitive data?
It can audit, deny, or redact based on the policy action and data identifiers you configure, so it can enforce protection rather than only report findings.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →